Update CHANGELOG.md when a GitHub release is published

import base64, datetime
from clickruntime import on_event, credentials, http, verify

SKIP_PRERELEASE = True

def gh(method, path, **kw):
    resp = http.request(method, f"https://api.github.com{path}", headers={
        "Authorization": f"Bearer {credentials.connection('github', 'work')}",
        "Accept": "application/vnd.github+json"}, **kw)
    resp.raise_for_status()
    return resp.json() if resp.content else None

@on_event
def handle(event):
    if not verify.github(event.body, event.header("X-Hub-Signature-256"), credentials.secret("GITHUB_WEBHOOK_SECRET")):
        return {"ignored": "bad signature"}
    body = event.json
    if event.header("X-GitHub-Event") != "release" or body.get("action") != "published":
        return {"ignored": True}
    rel, repo = body["release"], body["repository"]
    if SKIP_PRERELEASE and rel.get("prerelease"):
        return {"ignored": "prerelease"}
    path, branch = f"/repos/{repo['full_name']}/contents/CHANGELOG.md", repo["default_branch"]
    try:
        cur = gh("GET", path, params={"ref": branch})
        text, sha = base64.b64decode(cur["content"]).decode(), cur["sha"]
    except Exception:
        text, sha = "# Changelog\n", None
    if f"## {rel['tag_name']} " in text:
        return {"ignored": "already in changelog"}
    day = (rel.get("published_at") or datetime.datetime.utcnow().isoformat())[:10]
    section = f"## {rel['tag_name']} ({day})\n\n{(rel.get('body') or 'No notes.').strip()}\n\n"
    head, _, rest = text.partition("\n")
    new = f"{head}\n\n{section}{rest.lstrip()}" if head.startswith("# ") else section + text
    payload = {"message": f"docs: changelog for {rel['tag_name']}", "branch": branch,
               "content": base64.b64encode(new.encode()).decode()}
    if sha:
        payload["sha"] = sha
    gh("PUT", path, json=payload)
    return {"tag": rel["tag_name"]}